Merge pull request #7727 from nextcloud/fix/check-attachments

grnd-alt · web-flow · commit c9d1789f1ef7 · 2026-03-11T09:58:05.000+01:00
fix: check cardId for attachment
diff --git a/lib/Service/AttachmentService.php b/lib/Service/AttachmentService.php
@@ -251,6 +251,7 @@ public function update(int $cardId, int $attachmentId, string $data, string $typ
 		}
 
 		if ($service instanceof ICustomAttachmentService) {
+			$this->permissionService->checkPermission($this->cardMapper, $cardId, Acl::PERMISSION_EDIT);
 			try {
 				$attachment = new Attachment();
 				$attachment->setId($attachmentId);

Original file line number	Diff line number	Diff line change
`@@ -251,6 +251,7 @@ public function update(int $cardId, int $attachmentId, string $data, string $typ`
`251`	`251`	`}`
`252`	`252`
`253`	`253`	`if ($service instanceof ICustomAttachmentService) {`
	`254`	`+ $this->permissionService->checkPermission($this->cardMapper, $cardId, Acl::PERMISSION_EDIT);`
`254`	`255`	`try {`
`255`	`256`	`$attachment = new Attachment();`
`256`	`257`	`$attachment->setId($attachmentId);`